b-hermes/vulnerability-research

Releases0

Selected public vulnerability research, CVE writeups, SSRF/parser bypasses, and AppSec findings.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-48450 ↗	Oct 25, 2024Friday, 25 October 2024, 19:15	6.5 MEDIUM	—
An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group.
CVE-2024-48448 ↗	Oct 25, 2024Friday, 25 October 2024, 18:15	6.1 MEDIUM	—
An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page.
CVE-2024-29318 ↗	Jul 5, 2024Friday, 5 July 2024, 16:15	5.4 MEDIUM	—
Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code.
CVE-2024-29319 ↗	Jul 5, 2024Friday, 5 July 2024, 16:15	9.8 CRITICAL	—
Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls.
CVE-2024-27705 ↗	Apr 3, 2024Wednesday, 3 April 2024, 22:15	7.6 HIGH	—
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.
CVE-2024-27706 ↗	Apr 3, 2024Wednesday, 3 April 2024, 21:15	6.1 MEDIUM	—
Cross Site Scripting vulnerability in Huly Platform v.0.6.202 allows attackers to execute arbitrary code via upload of crafted SVG file to issues.
CVE-2024-28434 ↗	Mar 25, 2024Monday, 25 March 2024, 14:15	7.6 HIGH	—
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the javascript code.
CVE-2024-28435 ↗	Mar 25, 2024Monday, 25 March 2024, 14:15	5.4 MEDIUM	—
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
CVE-2024-27703 ↗	Mar 13, 2024Wednesday, 13 March 2024, 22:15	5.4 MEDIUM	—
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.
CVE-2024-27707 ↗	Mar 7, 2024Thursday, 7 March 2024, 21:15	4.3 MEDIUM	—
Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file.